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SECTION 1 


INTRODUCTION 


One way to lower the cost of aircraft and improve system reliabil- 
ity is to integrate the avionics functions. There is presently consid- 
erable interest in replacing the multiple sensors of a typical modem 
commercial aircraft with a skewed array of strapdown inertial navigation 
sensors. Redundant computers are used to perform multiple functions such 
as flight control, air-data processing, and strapdown navigation. Net 
cost has been shown to be less than for the current non-integrated 
systems. The integrated avionics approach depends upon redundancy to 
achieve the required reliability. Because flight control. System reli- 
ability and safety depend upon integrated avionics reliability, thorough 
analysis of skewed sensor system reliability is essential. 

The present study was undertaken within the context of this frame- 
work. It involved the evaluation and analysis of the Redundant Strapdown 
Inertial Measurement Unit (RSDIMU) being developed and evaluated by the 
NASA Langley Research Center. The work was conducted by The Charles 
Stark Draper Laboratory, Inc. (CSDL) under NASA Contract NASI -16887 
entitled the False Alarm/Reliability Analyses for a Separated Dual-Fail 
Operational Redundant Strapdown Inertial Measurement Unit. It is a 
follow-on to previous efforts described in References 1 and 2. The goal 
of the initial effort was to assess the feasibility of performing failure 
detection and isolation (FDI) for the RSDIMU in an air transport environ- 
ment, develop and evaluate FDI algorithms for the RSDIMU, and analyze FDI 
system performance. In Reference 2, a methodology for quantitatively 
analyzing the reliability of redundant avionics systems in general and 
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the dual, separated RSDIMU system in particular is developed and applied 
using a Markov model reliability analysis tool. The results of the 
parametric study of significant instrument and FDI system variables are 
presented and discussed. 

The detection and isolation of failures of the dual, separated 
RSDIMU is accomplished by comparing a function of the sensor outputs with 
a threshold. The separation of the RSDIMU into two separated clusters 
severely complicates the selection of the thresholds. The incremental 
structural mode and accelerometer lever arm effects between the locations 
of the two instrument clusters must be taken into account. In Reference 
2, a technique is developed and analyzed for generating the thresholds 
for a dual, separated RSDIMU taking into account factors such as the 
sensor errors, the aircraft dynamic environment, accelerometer lever arm 
effects and vehicle structural modes. 

The present effort was conducted to further develop and refine the 
technical knowledge and skills needed to make redundant strapdown IMUs a 
viable component of the aircraft avionics system inventory. Two major 
efforts were undertaken. The first was an Aeroelastic Effects Analysis, 
the major goal of which was to develop a methodology to determine the 
effects of aircraft aeroelasticity on gyro and accelerometer FDI system 
capability. Particular emphasis was placed on determining the effects 
and sensitivity of FDI system capability to the mounting location of a 
physically separated RSDIMU. Another of CSDL's goals with regard to this 
subject was to develop and evaluate a technique for generating FDI system 
thresholds which account for aeroelastic effects and which are valid for 
multiple, nonconcurrent failures. CSDL’s deterministic digital aircraft 
simulation was used to assess the impact of the aeroelastic effects on 
the capability of the FDI system and evaluate the effectiveness of the 
method developed for generating the dynamic thresholds. 

CSDL also investigated the concept of Failure Decision Function 
Compensation. The goal of this task was to account for the vehicle 
environment by compensating the failure decision function by the parity 
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residual error covariance (Reference 3). The major intent is to assess 
the feasibility of this approach and compare it with the dynamic 
threshold compensation method* The method to be investigated uses the 
Generalized Likelihood Test ( GLT) with a more general form of the failure 
decision and isolation functions than has been considered in the previous 
phases of this study. 

The report is organized as follows* Section 2 contains background 
information regarding the results of previous work conducted by the C.S. 
Draper Laboratory with regard to the RSDIMU* A comparison of Generalized 
Likelihood Test FDI algorithms is contained in Section 3* The comparison 
is made between failure decision functions which are compensated for 
sensor errors or else normalized with respect to them* The intent of 
this section is to determine if the use of compensated decision functions 
can eliminate the need for the dynamic failure detection thresholds 
required with the normalized decision function. Section 4 contains a 
discussion of noise compensation in the thresholds of the FDI GLT algo- 
rithm, a subject which has not been addressed up to this point in the 
consideration of the RSDIMU but which is shown to be necessary to elimi- 
nate false alarms. A consideration of the effects of sensor location and 
magnitude of the structural modes on FDI system performance is presented 
in Section 5. This topic is significant since the designers of aircraft 
systems using an RSDIMU will have to account for these factors. Section 
6 is devoted to the development and analysis of an algorithm for generat- 
ing the failure detection thresholds of the GLT algorithm using noise 
compensation and filtered parity equation residuals. The latter is a 
method of obtaining exact compensation of the high frequency structural 
mode and accelerometer lever arm effects. Section 7 presents an FDI 
strategy based on the pairwise comparison of sensor measurements. This 
strategy uses GLT derived detection decision functions. It has the 
specific additional advantage of successfully detecting and isolating up 
to two simultaneously occurring failures. The limitations of this 
advantage are also demonstrated. Finally, the contents of this report 
are summarized and the major conclusions are presented in Section 8. 
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SECTION 2 


BACKGROUND 


2.1 Sensor Configuration 

The inertial measurement unit shown in Figure 1 is a redundant . 
strapdown package employing four two -degree -of -freedom ( TDOF ) gyros 
(accelerometers) in a semi -octahedral geometry. Hie instruments are 
positioned such that the spin (pendulous) axes are normal to the four 
faces of the semi -octahedron and point out. The two measurement axes of 
the gyros and accelerometers lie in the plane of the face and are 
symmetric about the face centerline. The RSDIMU consists of two separate 
packages (faces 1 and 2, faces 3 and 4) which may be spatially separated 
along a track in the lateral direction. Thus it may be treated as two 
tetradic IMUs as indicated in Figure 2. The reason for separating the 
RSDIMU into two halves is to provide protection against damage effects 
due to lightning, structural failure, etc. The benefits of redundancy in 
the form of improved system reliability are retained by using sensor 
information from both halves of the IMU for failure detection and isola- 
tion purposes. 

The nominal geometry matrix, defining the sensor input axes 
relative to the vehicle body axes is 
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The dashed line indicates the separation of the RSDIMU into two halves. 
The nominal sensor error parameters used in this study are presented in 
Table 1 • 
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2.2 General Concepts of FDI 

This section is included to provide the reader with a background 
in the general concepts applied to detect and isolate sensor failures. 

It will allow a greater understanding and appreciation of the material 
presented in the following sections of the report. 

In order to detect and isolate sensor failures, a system of parity 
equations is solved. Parity equations are linear combinations of the 
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Table 
Nominal Sensor 

1 

Parameters 

PARAMETER 

VALUE 

Gyros 


Bias 

0.01 deg/hr 

Scale Factor Error 

20.0 ppm 

Misalignment 

50.0 prad 

g Dependent Errors 

0.005 deg/hr/g 

g 2 Dependent Errors 

0.02 -deg/hr/g 2 

u> 2 Dependent Errors 

12.4 deg/hr/ (rad/sec) ^ 

Accelerometers 


Bias 

50 pg 

Scale Factor Error 

50 ppm 

Misalignment 

50.0 prad 

Input-Pendulous Axes 
Acceleration Sensitivity 
Coefficient 

70 pg/g 2 

Input Axis Accelerometer 
Squared Sensitivity 
Coefficients 

20 pg/g 2 


I 
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sensor outputs selected to enhance the uncertainties (failures) associ- 
ated with the sensors. Furthermore , the effects of the quantity which 
the instruments measure, i.e., the angular rates or linear accelerations, 
are removed from consideration by the parity equations. 

Failure detection occurs as a result of comparing the parity 
equation residuals or a function of them to a threshold. If the thresh- 
old is exceeded, a failure is declared and the failure is then isolated. 
Failure isolation is accomplished using the parity equation residuals. 
Several methods are used depending upon the algorithm employed. Logical 
operations based on the residuals which exceed the threshold is one 
technique used, e.g., a combination of residuals exceeding the thresholds 
indicates the failure of a particular sensor. Another approach involves 
the dot product of the vector of parity equation residuals with vectors 
defined by the coefficients of the parity equations to isolate a failure. 

'This, in essence, is the methodology applied to detect and isolate 
sensor failures. However, complications arise when it is applied to a 
practical situation. For example, the parity equation residuals are 
ideally zero when a failure is not present and nonzero when a failure has 
occurred. In reality, the residuals are nonzero because of the uncer- 
tainties associated with the sensors, i.e., the sensor errors, sensor 
noise, structural mode effects, accelerometer lever-arm effects, etc. 

The residuals due to these factors dictate the level of failure which can 
be detected since they do not arise from failures and are a result of 
normal, although undesirable, sensor behavior. In a dynamic environment 
these uncertainties may be excited to a greater degree. To avoid the 
false detection of failures, i.e., false alarms, the thresholds may have 
to be compensated for this effect. One possible approach to handling 
this problem is the use of dynamic thresholds which are a function of the 
environment. Another is in-flight identification and compensation of the 
sensor error effects in the FDI decision process. 

Normally, unfiltered sensor data is used to detect and isolate 
sensor failures of a large magnitude since it is desired to remove their 
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effects before they affect the controllability of the vehicle* Another 
factor in the design of FDI systems is that the effects of small 
magnitude failures may be masked by the instrument uncertainty effects* 
Filtering of the parity equation residuals may have to be introduced into 
the FDI system to enhance their detectability. This is at the expense of 
a longer detection time and a design tradeoff exists. The presence of 
several channels in the FDI system to detect and isolate different levels 
of failures may result. 


2.3 Description of the Generalized Likelihood Test Failure 
Detection and Isolation Algorithm 

The Generalized Likelihood Test Failure Detection and Isolation 
algorithm has been used during this study. A brief description of it 
follows. Three levels of failure are to be detected and isolated. They 
are: 


• Hard failures; those of a comparatively large magnitude, which 
primarily affect flight-control performance. 

• Midvalue failures: those of medium magnitude, which affect 

pilot display performance. 

• Soft failures: those of a comparatively small magnitude, which 

affect navigation performance. 


Consider first the hard failure channel. In the absence of sensor 
failures, the measurement equation is 


m = Ha) + £ 

A set of parity equations is defined by 


where 


p = Vra 
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VH = 0 

V is assumed to be of dimension (n-3)xn. The matrix V can be chosen so 
that 


T 

VV » I 

Combining the previous equations yields 


In the absence of sensor failures, p N depends only on the measurement 
noise. If sensor j experiences a bias-type failure and that failure is 
manifest as an apparent bias shift of magnitude b in measurement j, then 

p„ = V 5 + V.b 
F * } 

The difference in the statistics of p„ (in the absence of failures) and 
p (in the presence of failures) provides a basis for detecting and 
isolating failures. The problems of detecting and isolating sensor 
failures fall within the general framework of composite hypothesis tests , 
since the sign as well as the magnitude of the bias failure is unknown a 
priori. 

A GLT formation of the detection and isolation problems has been 
developed. Assume single-axis failures for simplicity. The GLT decision 
functions for detection and isolation are 


T -1 

DF = pC p 
D p 


DF 


I. 

3 


(p T c -Yy 

ll__P V 
T -1 

v:c v. 

DP D 


j = 1 , 2 , . . . ,n 


( 1 ) 


(2) 
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The detection decision is made by comparing DF^ to a detection threshold. 
A sensor failure results in a change in the mean value of a sensor out- 
put, the parity-equation residuals, and the failure-detection function. 
The isolation decision is then made by determining maxj (DFj ^ ) • The value 
of j that maximizes DF^ identifies the sensor that is most likely to 
have failed. 


The form of the failure detection and isolation functions pre- 
sented in the previous paragraph is more general than that used in the 
prior studies of the RSDIMU in that the effect of Cp is included. 
Decision functions, normalized to remove the effect of Cp, have been 
investigated previously. A comparison of these two decision function 
forms is presented in Section 3. 

The detection and isolation of the mid and soft failures is 
accomplished using the same decision functions as for the hard-failure 
channel. The only exception is that the appropriately filtered parity- 
equation residuals are used in lieu of the unfiltered ones. Figure 3 is 
a block diagram of the FDI which has evolved during this program. 


2 .4 System Simulation and Evaluation Trajectories 

A digital aircraft simulation was used during this study to 
evaluate the technical areas and tasks of the Statement of Work. A block 
diagram of the simulation used is shown in Figure 4. The core of the 
simulation is a six-degree of freedom aircraft model with nonlinear 
aerodynamics. Also modeled are a flight control system and turbulence. 

An autopilot "commands" the vehicle to follow a desired trajectory 
profile. Skewed gyro and accelerometer sensor configurations are modeled 
with the location of the sensors variable to permit an assessment of 
accelerometer lever-arm effects. The sensors are assumed to be of 
navigation quality and used for navigation and flight control purposes. 
The FDI algorithm operates on the sensor data to generate the input 
signals to the flight control and navigation systems • Navigation accu- 
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SENSOR DATA 



Figure 3 . FDI Algorithm Block Diagram 
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PROFILE 



Figure 4. Simulation Block Diagram 










racy is assessed by differencing the outputs of a strapdown local- 
vertical-wander-azimuth navigation system model and the vehicle states. 

Table 2 shows the longer of the two flight profiles used to 
evaluate the fault-tolerant system during the dynamic phases of vehicle 
flight. The profile includes features from a typical transport aircraft 
mission profile: a climb to altitude, cruise, heading changes, descent, 

and a loiter maneuver. Shorter 110 seconds and 500 second profiles were 
also used during this study. The 110-second profile is outlined in Table 
3, and the 500-second profile is all-cruise. 

2.5 Separated Sensor Effects 

The present program is concerned with the development and evalua- 
tion of an analytic technique for the generation of EDI thresholds for an 
aircraft system with dual, separated IMUs. The intent is to use all 
available instruments of both IMUs to detect and isolate sensor 
failures. The separation of the IMUs hinders failure detection and 
isolation, since the raw structural -mode and accelerometer lever-arm 
effects which the instruments sense are comparable in magnitude to the 
failures which may be encountered and can result in the false detection 
of failures if not properly accounted for. The selection of thresholds, 
a major consideration in the development of any FDI system, is especially 
complicated when separated, communicating IMUs are present, since these 
additional factors must be taken into account. A spectrum of failure 
magnitudes from hard through soft is considered. Finally, aircraft 
maneuvering adds a significant dimension to the problem. The 
structural-mode and accelerometer lever arm effects are now defined. 

2.5.1 Structural -Mode Effects 

Each structural mode can be represented by a second-order 
differential equation with additional terms which, in general, couple in 
the basic rigid-body airframe response, the other modes, and the 
control -surface deflections. The effect of the structural modes on the 
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Table 2 

30 Minute Evaluation Trajectory 


TIME 

(sec) 

EVENT 

ALTITUDE 

(m) 

VELOCITY 

(m/sec) 

0-50 

Cruise 

1497 

166 

50 - 300 

Ascent 



300 - 500 

Cruise 

3974 

205 

500 - 550 

1 0° Heading Change 



550 - 750 

Descent 



750 - 765 

10° Heading Change 



765 - 1000 

Cruise 

1497 

166 

1000-1015 

10° Heading Change 



1015 - 1105 

Cruise 



1195 - 1705 

Loiter, one 360° turn 



1705 - 1800 

Cruise 

1497 

166 


16 







Table 3 

110 Second Flight Trajectory 


TIME 

(sec) 

EVENT 

0-40 

Cruise 

40 - 100 

3 deg/mi n Climb 


20 deg/min Bank 


90 deg/min Heading Change 

110 - 110 

Cruise, 20 deg Bank Angle 
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angular rates and linear accelerations is a function of sensor locations 
and is indicated by the following equations. 


P B - P + sp B - P + p; » 4 + p; p 5 * p; \ 

4 5 6 


q B - q + «q B - q + q^n, + q^n 2 - S 3 n 3 


r = r + 5r = r + r» n, 
B B n 6 6 


n =n+6n = n + n n- 

y y y„ y y. . 6 

*B 1 B r\ 


n z = n z + 6n z = n z + n z.. n i + n z.. n 2 + n z.. n 3 
B B n 1 n 2 n 3 


(3) 


2.5.2 Accelerometer Lever-Arm Effects 

The linear accelerations measured at a distance d meters from the 
c.g. of the vehicle (in terms of the linear accelerations at the c.g. of 
the vehicle and the accelerometer lever-arm effects) are defined by the 
following equations. 



n + Sn 
x x„ 

eg la 

n x + ~ • [-(q 2 + r 2 )d x + (qp - r)d + (q + pr)d z j 

eg ♦ 


n + 6n 
Y cg y £a 


1 

n + — 

y G 

eg <p 


[(r + Pq)^ x - (p + r )d y + (rq - p)d z ] 
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n 


n + <5n 
z z « 

eg £a 

n + * f(pr - q)d + (qr + p)d - (p 2 + q 2 )d ] (4) 

z G. 1 x y z J 

eg <p 


2.6 The Derivation of Dynamic Thresholds 

The basic approach is to start with an analytic expression for the 
sensor error, structural -mode, and lever-arm effects and obtain expres- 
sions for the parity-equation residuals. Upper bounds for the parity- 
equation residuals are then determined. The FDI system threshold is 
generated by duplicating the steps involved in the computation of the 
failure-decision function using the upper bounds for the parity-equation 
residuals rather than the actual residuals. A block diagram of the 
process for the mid or soft failure channel is shown in Figure 5. 

It is necessary to write expressions for the linear accelerations 
at one IMU location in terms of those at the others. Using the right 
half of the RSDIMU as a reference and Eqs. (3) and (4) leads to the 
following results. 


n 4* fin 
X R 


n + <5n - 6n 

X X . X _ 

R Jta T £a„ 

L R 


n = n + 6n 
y L y R y 


= n 4- 6n - 5n 4- 5n - 6n 

y * x x \ \ 
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n + 6n 
Z R 


= n + 6n - <$n + 6n - 5n 


z_ z „ 

R £a„ 


fa. 


B. 


B_ 


The output of the jth accelerometer of the right IMU can be 
written as 


m 


■ DT»G {h. • n + H • n + H. • n + 6m } 

a j ♦ 31 X R 32 33 z R a.t 

j = A3, B3, A4, B4 


(5) 


6m a ^ is a term representing the sensor errors. The sensor models assumed 
for this study, described in detail in Reference 1 , result in 


6m 


a. 

3 


= DT»G {X. + (y., + e. • H. )n + (y._ + e. • H.„)n 
♦ 3 31 3 3 1 x p 3 2 3 32 1 


+ ( y + e. • H )n 
33 3 33 z t 


+ a__ (H • n + H., • n + H. • n ) 
“j 3 ’ *R 32 y R 33 Z R 


• (rf, • n + H? • n + H? • n ) 
31 X R 32 y R 33 Z R 


+ 3 tt (H., • n + H.„ • n + H. , • n ) 2 \ 
I3C j 31 X R 32 y R 33 Z R ' 


j = A3, B3, A4, B4 


(6) 


A similar expression is obtained for the output of the kth accelerometer 
of the left IMU using the appropriate accelerations. Use of the 
equations for the accelerations measured by the left half of the RSDIMU 
in terms of those of the right half leads to 
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DT,S + K, • V + \2 • V + "k3 • V 

y R J R R 

+ *\ + \l * 6n x + \2 * 6n y + \3 * 6n z^ 

k = A1 , B1 , A2 , B2 


(7) 


Substituting Eq. (5) and (7) into the parity equations results in 
the following residuals 


»i - ? V ij 6 V * l W\ * "k2% * \3 6 V ”•% 

J 3 k 


i = 1,2,...,n-3; j « A1 ,B1 , . • . , A4,B4; k = A1,B1,A2,B2 


(8) 


This expression results since VH = 0. It consists of two terms. The 
first results from the sensor errors and the second from the incremental 
structural mode and lever-arm effects between the locations of the two 
halves of the RSDIMU. 

An upper bound for Eq. (8) is 


»i ■ ( ? | V ij|) 5 “a * I l V lk (H k 1 6n * + \2 {n s- * \3 5n z’ 

m 1 m k - 


DT*G , 


i = 1 , 2, . • . ,n-3; j = A1 ,B1 , . . . , A4 , B4; k = A1 , B1 , A2 , B2 


( 9 ) 


The dynamic threshold is then obtained by summing the squares of the 
upper bound for each parity equation, i.e., duplicating the generation of 
the decision function. The resulting expression is 


T 


n-3 

X (pi ) 

i=1 


m 


( 10 ) 


hence 


In order to calculate the FDI system thresholds, Eq. (10), and 
Eq. (9), must be calculated in real time. Consider the first term 
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of Eq. (9). The Vj_j*s are known and 6m a ^ is an analytic expression for 
the upper bound of the sensor error effects given by 


6m * DT»G, {X +y fin |+|n |+|n M 

a m 4> 1 a a M x | | y | I z I > 

m m m r r r 

+ e (|o.788675n | + |o.788675n | + |o.577350n. |) 

a m 1 X f y f' 1 Z f' 

+ (0 It + a Ip ) [{ |o.788675n x j + |o.788675n y | + 1 0.577350n z | ) 2 ] f } 
m m 

(11 ) 


6m a is obtained from Eq* (6) by assuming worst case conditions, 
m _ _ 

P p 

For example , the magnitude of H H^, and H^ 2 is less than or equal 

to 0.788675, and the sensor errors are additive and bounded by their 3a 
values . 


Each term of Eq. (9) also contains a term which reflects the 
incremental value of the separation effects between the two IMU loca- 
tions. If three or more independent measurements are available at each 
IMU location, the required quantities can be obtained by generating a 

least-squares solution for n , n , and n at each IMU location and 

x y z 

differencing like quantities. This approach falls apart after the first 
failure is detected and isolated since one instrument is analytically 
removed from the system. Therefore, a least-squares solution can be 
obtained for only one IMU. 


Reference 2 presents a technique for generating the incremental 
separation effects which overcomes the deficiencies of the approach 
described in the previous paragraph. The least-squares solution of only 
one of the IMUs is required. Assume for the purposes of discussion that 
the right IMU is selected as the reference. A least-squares solution can 
be obtained for the right IMU resulting in the estimated quantities n XR , 

A A 

n y R , and n ZR . An estimate of the separation effects on the instruments 

A A A 

of the left IMU can be obtained by using n XR , n y R » and n Zp to generate an 
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estimate of the measurements of the left IMU and subtracting them from 
the actual measurements. For example. 


A 

m 

= DT*G 

9 

{“n x - 

A 

’ ^ ■ 

a A1 

X R 

y R 

6m 

= m 

a 

■ m 


a A1 

a A1 

a A1 



= DT>G 

<P 

{° (n x 

A 

- n ) 


X L 

R 


II 

D 

• 

O 

-e- 

l* 4 ”* 

$6n 

Following 

this procedure leads to 


6m = 

a B1 

DT*G 

9 

{-6«n- x 


6m = 

DT*G 

9 

1 6SS * 


a A2 


6m = 

DT »G . 
<P 

{-a&n 


a B2 

X 


y y z z 

y L L R 


Since the right IMU is the reference 
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The quantities needed for the thresholds are obtained by resolving the 
uncertainties of Eqs. (12), (13) and (14) through the parity equations, 
that is, solving the parity equations using these quantities for the 
sensor measurements. The absolute value of the solution is then used for 
the threshold. 

Several additional items regarding the thresholds should be 
pointed out at this time. One is that the last value of the linear 
accelerations (generated for the flight-control system from the sensor 
signals) can be used to generate the thresholds. Using these signals 
results in thresholds which reflect the current state of the aircraft and 
its environment. In order to make a valid comparison between the 
residuals and thresholds, it is necessary to filter each in an identical 
fashion. It is preferable to filter the quantities required for the 
thresholds before the maximization and absolute values are generated. 

This results in a reduced level of noise which is not subject to maximi- 
zation and leads to lower, more realistic thresholds. The subscript f in 

Eq. (11) indicates where the filtering of 6m a should occur in the 

n\ 

generation of the thresholds. 

The effect of failures on the thresholds has also been consid- 
ered. The statistics of the parity equation residuals change to reflect 
the presence of a failure, e.g., the mean changes due to a bias failure. 
The thresholds will also change due to the failure, and detection and 
isolation is not possible. Modifications must be made to the FDI 
algorithm to eliminate this deficiency. The technique employed is to 
pass the estimated separation effects through washout filters before 
taking the absolute value for the thresholds. Washout filtering removes 
the effect of the instrument biases and bias failures from the separation 
effects so that the thresholds return to their prefailure values. The 
parity equation residuals change to reflect the effect of the failures 
and failure detection and isolation occurs when the thresholds are 
exceeded. 
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SECTION 3 


A COMPARISON OF THE COMPENSATED AND 
' UNCOMPENSATED GLT DECISION FUNCTIONS 


3.1 Introduction 

Previous investigations of the RSDIMU (References 1 and 2) have 
been concerned with the uncompensated GLT algorithm. That is, the 
decision functions of Eq. (1) and (2) have been used with the covariance 
matrix Cp = I* Simpler decision functions resulted. However, dynamic 
threshold compensation had to be employed to account for the aircraft 
system's environment, the sensor errors and the structural mode and 
accelerometer lever arm effects. 

This section compares the uncompensated and compensated GLT 
decision functions. The motivation for investigating the compensated 
decision function is that it may be possible to employ constant thresh- 
olds if the sensed error effects are compensated for in the decision 
function. A simpler system with improved FDI performance may be 
possible. 

A derivation of an analytic expression for the covariance matrix 
Cp , required for decision function compensation, is presented. This 
algorithm was implemented in the CSDL digital aircraft simulation and its 
FDI capability evaluated. Conclusions regarding the feasibility of this 
approach, its pros and cons and a comparison with results obtained for 
the uncompensated GLT decision function are presented. Colocated sensors 
are assumed for the initial evaluation, thereby simplifying the evalua- 
tion of the concept since the structural mode and accelerometer effects 
can be neglected. Reference 3 provided the basis for this study. 
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3.2 Derivation of the Error Covariance Matrix 

In the presence of instrument errors, the instrument outputs can 
be represented by 


m = Ha) + e, + e^ + ....e, 
—1 —2 — k 


Thus, the parity vector can be written as 


p = Vm = Ve H + Ve + . .Ve 
— *1 —2 — k 


e, + e + .. e, 
—1 —2 -k 


Assuming that the error sources e^ are uncorrelated, the covariance of 
p, C p is given by 


C = C +C +..C 
p 1 2 k 


where 


C. = E[e.e T ] = VE[e.e T ]v T 

i L -i-i J L -i-i J 


VR. V 

i 


and R. is the covariance of e. . 
l -i 

The error sources for the two-degree -of -freedom instruments 
considered are: 


e^ = error due to instrument biases 

e^ = error due to scale factor errors and input axis 
misalignments 
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= error due to g-sensitivities of the input axes (g- 
sensitive bias) 

e^ = quantization and sensor noise 

The covariance of the error term due to instrument biases and 
hysteresis is given by 


R 


1 


where 



• a is the sum of the squares of the 1 -sigma values of the 
instrument bias, hysteresis, etc. 

• p c is the correlation coefficient between the instrument pair. 

The covariance matrix R 1 is of dimension [nxn] . 

The error term e 2 is given by 

-2 * V 

where the elements of Hj,, represent the instrument scale factor errors 
and input axis misalignments. The contribution of this term to the total 
parity vector is given by 
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e = VH a) 
—2 m 


= Aw 


can also be expressed as 


-2 = 


where 


Q = 


-T 

0) 


! 0 0 0 



0 0 0 


aT 

0) 


0 0 0 I 


aT 

0) 


and 


= (A A A A A A • • • A A A ) 
11 12 13 21 22 23 ml m2 m3 


where u> is the most recent estimate of u) 


0) 


T -1 
( Hh) 


T 

H m 


Therefore, C 2 is calculated as 


c = a r a 
2 a 
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The derivation of R includes the cross correlation between the instru- 

a_ 

ment pairs. 

a_ can also be expressed as 


a 


V*h 


-m 


where 


V* 


V 11 Z 3 V 12 I 3 


V 21 Z 3 


L n-3,1 3 


V. 

In 3 


V 0 I. 
2n 3 


V _ T 
n-3,n 3 


and 


h = [H H H H ...... H 1 T 

"'ll "*12 ®13 "*21 “n3 


The covariance of a^ is given by 


R - E[a a T ] = E[V*h h T V* T ] 
a — — —in — m 


* *T 
= V R V 
m 


where 


R = E[h h ] 
n -in — m 
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The vector h may be partitioned as follows; 
-m 


m T T 

h = [h h 
-m -m^ -m^ 


T 

... h ] 
-m 

n 


where h^ is the i-th row of H m . Since the instrument errors between 
each instrument axis pair are dependent 


r R 

m 




11 


m 


21 


m 


12 
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0 1 0 
3x3 , 3x3 


°3x3 1 °3x3 


R 1 R ™ 
m__ , 34 

33 
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ni JA m _ . 

43 | 44 


m 


n-1 ,n-1 


i m - 

I n,n-1 


m 


n-1 ,n 


m 


nn 


where 


m. . 
ID 


E[h h ] 
— m . — m . 
i D 


has dimension [3n x 3n]. 


R a can be written as (see Reference 3) 


R a " °MIS I 3(n-1 )x3(n-1 ) + ( °SF “ °MIS ) V R m V 
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Thus, C 2 is given by 


- S[o 2 


MIS 3(n-1 )x3(n-1 ) 


+ (a 


SF 


- a. 


MIS 


)V*R V* T ]fl T 
m J 


The ith element of the error term due to the g-sensitivity of the 
input axes, e^» is given by 


e_. » n H. _ S . 

-3i z i3 gi 


It is assumed that the normal acceleration is much greater than the 
longitudinal and lateral accelerations. 

Thus, R 3 can be written 


e 's 3 sI 1 


Therefore, 


2 2 
n a 0 
z S 


H 


13 


‘23 


n3 


C. = 


(ll dq 

z s 

g 


H 


13 


H 


n3 
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Sensor noise is not considered in this phase of the study. The 
quantization compensation parameter is obtained from a straight and level 
flight simulation in the absence of sensor noise and error. A compensa- 
tion magnitude which corresponds to a bias error of 0.03 deg/hr has been 
used nominally. 

To summarize, the error-compensated detection decision function 
can be described as 


D'ue - e T tv(R, * R 2 * Rj + R,)vV'p 


p T tc, ♦ c 2 ♦ c 3 + c 4 r’ P 


T -1 

P c p p 


At each measurement sampling period, Cp is updated and the compensated 
decision function compared to a threshold to determine whether a failure 
has occurred. When a failure is detected, it is isolated to the sensor 
which maximizes the compensated isolation decision function given by 
Equation (2). 

3.3 Results 

Simulation results were obtained for the purpose of comparing the 
uncompensated and compensated decision functions for failure detection 
purposes. Two forms of the compensated failure detection decision were 
actually compared; the complete one as derived in the previous section 
and a simplified one determined using only the diagonal elements of C p 
in the compensation. This, of course, simplifies the calculation of Cp 1 . 

Figure 6 shows the compensated and uncompensated failure decision 
functions obtained for the nominal sensor error parameters. The effect 
of the compensation is reflected in the difference in magnitude between 
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the two types of decision functions* Furthermore, it is apparent that 
the compensation is not perfect as evidenced by the peaks in the compen- 
sated decision function which occur when the vehicle maneuvers. This 
means that the sensor error effects will have to be accurately identified 
to achieve a decision function which is not affected by the vehicle 
dynamics so that constant thresholds can be implemented. Otherwise the 
risk of a high false alarm rate exists. The results of Figure 6 also 
indicate that the simplified compensated decision function may be used in 
lieu of the unsimplified one since their time histories are generally the 
same, differing only in magnitude. 

To allow a more thorough investigation of the compensated GLT 
decision function, the nominal error parameters used in the calculation 
of Cp were adjusted to reflect the variance of the actual sensor error 
parameters in the simulation. The scale factor and misalignment errors 
used to calculate Cp were increased by a factor of 5 and the g- 
sensitive errors by 24. Under this assumption, the peak value of the 
unsimplified compensated decision function was reduced by a factor of 6 
and the simplified one by a factor of 16. Fairly uniform decision 
functions resulted. 

Bias failures were introduced during the 30 minute simulation run 
according to the time history given in Table 4. In this table, as in 
others which follow, sensor axes 1 , 3, 5 and 7 correspond to axis A of 
instruments 1, 2, 3 and 4, respectively, while sensor axes 2, 4, 6 and 8 
correspond to axis B of the same instruments. The performance of the 
uncompensated and compensated GLT detection decision functions is shown 
in Figures 7, 8 and 9 for the adjusted sensor error parameter case. The 
results indicate that the compensated decision functions are quite 
sensitive to a failure during a relatively mild maneuver. However, the 
effect of the failure is not present in the decision function during 
large roll maneuvers. This is due to the effect of the dynamic compensa- 
tion term C 2 * No significant difference in performance can be observed 
between the simplified and unsimplified compensated detection decision 
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Figure 




Table 4 

Failure Profile for the 30 Minute Evaluation Trajectory 


TIME 

FAILURE MAGNITUDE 

SENSOR AXIS 

(sec) 

(deg/hr) 

FAILED 

505 

in 

• 

o 

4 

1005 

2.0 

4 

1205 

3.0 

4 • 
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Uncompensated 



Figure 8. Compensated and Uncompensated GLT Detection Decision Functions with 
Failures Present, Adjusted for Sensor Error Statistics, 500-1050 Sec 
of 30 Minute Evaluation Trajectory 



Uncompensated 



Figure 9. Compensated and Uncompensated GLT Detection Decision Function with 

Failures Present, Adjusted for Sensor Error Statistics, 1100-1750 Sec 
of 30 Minute Evaluation Trajectory 



functions. It is also apparent that the effect of the failure is not as 
clearly evident in the uncompensated decision function as in the compen- 
sated ones. 

To gain more insight into the performance of the compensated 
detection decision functions during large maneuvers the shorter 110 
second flight profile defined in Table 3 was considered. Results are 
shown in Figure 10 for the adjusted sensor parameter case with no 
failures. The corresponding results in the presence of failures are 
shown in Figure 11. The failure profile is presented in Table 5. The 
failure effect is clearly evident when the flight is level and unaccel- 
erated (0-40 sec). The sensitivity of the compensated detection decision 
function to the failure decreases during the maneuver. It appears that 
the failure can be detected with the simplified compensated detection 
decision function during the maneuver even though its magnitude has 
decreased at the start of the maneuver. Failure detection does not 
appear possible with the uncompensated detection decision function in 
this specific case. 

3.4 Conclusions 

The following conclusions can be drawn from this phase of the 

study* 

• The results obtained for the GLT FDI approach which compensates 
for the effects of sensor errors on the detection decision 
function looks encouraging. The study provided better insight 
into the failure detection process. 

• In all the cases considered, the use of only the diagonal 
elements in the computation of the detection decision function 
yielded very favorable results. This reduces the computational 
burden of inverting the updated matrix C p . 

• The compensated detection decision function shows remarkable 
sensitivity to small bias failures during level and unaccel- 
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110 Second Evaluation 



Figure 11. Compensated and Uncompensated GLT Detection Decision Functions 
with Failures Present, Adjusted for Sensor Error Statistics, 
110 Second Evaluation Trajectory 




Table 5 

Failure Profile for the 110 Second Evaluation Trajectory 


TIME 

FAILURE MAGNITUDE 

SENSOR AXIS 

(sec) 

(deg/hr) 

FAILED 

15 

in 

• 

o 

4 

50 

2.5 

4 

75 

3.0 

4 
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era ted flight and mild maneuvers. However, the problem of 
detecting failures during maneuvers is still unresolved. 


• It is still premature to consider this FDI scheme as 
tial alternative to dynamic threshold compensation, 
approach, however, deserves additional attention. 


a poten- 
This 
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SECTION 4 


NOISE COMPENSATION FOR Ft) I SYSTEMS 


The effects of sensor noise on the performance of the FDI system 
are investigated. This subject has received little attention thus far. 
The need for noise compensation in the dynamic thresholds is established 
and a method for accomplishing this is derived based upon the compensated 
detection decision function approach of the previous section. The 
magnitude of the noise level, the degree of noise compensation, i.e., 
whether to compensate la or 2a, etc., and the detection filter time 
constants are all considered in this phase of the study. The effects of 
sensor failures are also examined. 

4.1 Derivation of the Sensor Noise Compensation Algorithm 

The sensor noise is compensated for in the threshold by using the 
estimated noise variance. The parity equation residuals, the nominal 
sensor parameters, and the estimated lever arm and structural mode 
effects are used to estimate the noise variance. 

In the absence of failure, the parity equation residual is given 
by 


P 


Vm 


e + e + e 

-SE -NOISE -SM 


where 
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sensor error residuals 


e * sensor noise residuals excluding structural 

-NOISE 

mode and lever arm 


-SM 


= residuals due to structural mode and lever 
arm effect. 


The variance of the parity equation residuals is given by 


°p " E t (p)2 ] * Et £sE ] + El -NOISE 1 + Et -SM ] 

It is assumed that the three error sources are independent. The 
noise variance can be expressed as 


2 

a 

-NOISE 



The variance of the parity equation residuals can be computed dynamically 
from the time history of the parity equation. The sensor error contribu- 
tion is computed using the covariance estimation approach developed in 
the previous section. The variance of the structural mode and acceler- 
ometer lever arm effects is determined by taking the expected value of 
the square of the acceleration due to these quantities. 


4.2 Results 

The sensor noise compensation was implemented in the gyro soft 
failure channel only. Compensation was not used in the accelerometer 
channel because results indicated that this portion of the FDI system was 
not very sensitive to the presence of noise. Four important parameters 
that affect the performance of the FDI system were considered. They are 

• noise level, 

• magnitude of the noise compensation. 
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• time constant of the soft failure detection channel, 

• magnitude of the sensor failure. 

A straight and level cruise flight profile was used in all of the 
simulation runs. The effects of sensor separation and structural modes 
are not included for simplicity. 

The variance of the noise level is assumed to be constant for a 
given type of sensor. A value of 0.00284g was assumed for the acceler- 
ometers and 49.5 deg/hr for the gyros. The nominal level of the gyro 
noise compensation is la. The soft failure detection channel second 
order filter time constant is varied from the nominal value of /15.0 
seconds. A damping ratio of one is always assumed. Bias failures of 
various magnitudes have been considered. The failure profile is 

presented in Table 6 for the base case. 

/ 

Table 7 indicates the need for noise compensation in the gyro 
detection channel. The noise level must be about 5.0 deg/hr or less to 
avoid false alarms without compensation. The accelerometer detection 
channel, on the other hand, is not very sensitive to noise. Hence, 
accelerometer noise compensation may not be necessary. 

Table 8 summarizes the effect of the filter time constant on FDI 
system noise compensation. False alarms can be reduced by increasing the 
time constant of the filters. The accelerometer channel is not very 
sensitive to the filter time constant although there is a trend toward 
increasing detection time delay with increasing time constant. The 
results also indicate that the gyro channel time constants have to be 
large; about 100 seconds, without noise compensation. The use of large 
time constants alone to compensate for noise effects does not prevent the 
possibility of FDI system errors in the presence of sensor failures. The 
false isolation which occurred for the case where failures were intro- 
duced confirms this conclusion. 

The effects of noise compensation, the filter time constant and 
sensor failures on FDI system performance are summarized in Table 9. In 
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Table 6 

Failure Profile for Noise Compensation Study 


Accelerometer 
(Noise Level .00284 g) 


TIME 

MAGNITUDE 

FAILED SENSOR AXIS 

(sec) 

(g) 


60 

0.003 

4 

130 

0.003 

6 

200 

0.003 

8 


Gyro 

(Noise Level 49.5°/hr) 


TIME 

MAGNITUDE 

FAILED SEtJSOR AXIS 

(sec) 

(deg/hr) 


70 

4.0 

8 

140 

4.0 

6 

210 

4.0 

4 
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Table 7 

Effect of Sensor Noise Level on EDI System Performance 



51 



Effect of Filter Time Constant on FDI System Performance 
Nominal Noise Level, No Noise Compensation 
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the absence of a failure, no false alarm occurred in the soft gyro 
detection channel with la noise compensation. The gyro failure level 
that can be detected under these conditions is about 4.0 deg/hr. The . 
correct detection of a 2.0 deg/hr gyro failure is very sensitive to the 
filter time constant as indicated by Cases 2, 4, 5 and 6. False alarms 
can be avoided by increasing the level of noise compensation as demon- 
strated by Cases 8 and 9. 

Time histories of the soft failure channel thresholds and 
detection decision functions for two representative cases with sensor 
noise, with and without compensation, are presented in Figures 12 and 13, 
respectively. The soft failure channel filter time constant is /v5 sec 
and the nominal noise level is 49.5 deg/hr. A white noise model, with a 
power spectrum which is constant over all frequencies, was assumed. This 
characteristic accounts for the fact that soft failure decision functions 
on the order of tenths of a deg/hr are evident in Figures 12 and 13 and 
demonstrates a potential problem with FDI for the RSDIMU. The white 
noise model introduces signals at frequencies within the passband of the 
soft failure channel low pass filter which are attenuated very little 
compared to the high frequency noise components and possibly not at all 
in the worst case. 

Figure 12 was obtained for the system without noise compensation 
in the threshold. Three false alarms, due to the presence of the noise, 
were rapidly detected between 50 to 75 sec into the run, clearly demon- 
strating the need for compensation. The software was specifically 
written to exclude the detection of failures for the first 45 sec of a 
simulation run and is the reason that false alarms were not encountered 
prior to the times indicated on Figure 12. Furthermore, the software is 
also written so that the thresholds are not computed after three failures 
are detected and explains why the threshold is zero for times greater 
than 75 seconds. 

The results of Figure 13 were obtained with la noise compensation 
in the threshold and three 4 deg/hr failures introduced as indicated in 
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Figure 13- Gyro Soft Failure Channel Threshold and Detection Decision 
Function, Noise Compensation, Cruise Flight Condition 


Table 6. The nominal sensor error values were used to compute the noise 
compensation and not the adjusted values which led to the results 
presented in Figure 11. The three failures were detected and correctly 
isolated. In fact, the second failure was detected after the third was 
introduced and its effect not fully manifested in the decision function. 
The results of Figure 1 3 confirm the validity of noise compensation in 
the failure detection system thresholds. 

4.3 Summary and Conclusions 

The performance of the FDI algorithm in the presence of noise has 
been investigated. The effects of noise level, failure level, noise 
compensation level and filter time constants have been considered. A 
straight and level flight profile has been used for simulation purposes. 

Several conclusions were drawn during the course of this study. 
They were: 

• Gyro noise compensation is necessary to prevent false alarms. 
Without noise compensation, the gyro detection channel can only 
tolerate a low noise level of about 5 deg/hr. However, the 
accelerometer channel is not very sensitive to noise. 

• Noise can be compensated for by adjusting the filter time 
constants of the FDI system or by accounting for the presence 
of noise in the detection threshold using a covariance compu- 
tation scheme. 

• Large filter time constants by themselves are not sufficient to 
prevent false alarms in the presence of noise and failures. 
Noise compensation in the threshold is necessary. 

• A high level of noise compensation in the threshold provides a 
means of preventing false alarms at the expense of decreased 
failure detection capability. 
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SECTION 5 


THE EFFECT OF SENSOR LOCATION AND MAGNITUDE OF THE 
STRUCTURAL MODES ON FDI SYSTEM PERFORMANCE 


5.1 Introduction 

The impact of sensor location and magnitude of the structural mode 
effects on FDI system performance must be considered in the implementa- 
tion and utilization of an RSDIMU in an aircraft system* Given complete 
freedom, the aircraft control system designer will place the acceler- 
ometers at the nodes and the gyros at the antinodes of the structural 
modes to lessen their sensed effects. This freedom is taken away from 
the aircraft system designer when an RSDIMU is .implemented since the 
accelerometers and gyros are colocated. The implication of this restric- 
tion must be assessed. However, a complete and thorough study of sensor 
location and structural mode effects would be extremely complex, involv- 
ing a detailed consideration of control system stability, phase and gain 
margins, etc., which is definitely beyond the scope of the present 
effort. As a compromise, the subjects of sensor location and structural 
mode effects will be assessed via simulation. 

This task is divided into two parts. The first involves the 
investigation of the effects of sensor location on FDI system perform- 
ance. The two halves of the RSDIMU are placed at different locations 
along the vehicle fuselage. The structural mode coefficients are varied 
with the location of the RSDIMU. The presence of sensor failures is also 
evaluated. In the second part of this section, the effects of changes in 
the magnitudes of the structural modes are considered. The absolute 
values of all of the structural mode coefficients for an RSDIMU cluster 
are changed by a specified percent. In both cases, the 30 minute flight 
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profile of Table 2 is used. Sensor noise is not considered. The 
locations assumed for the RSDIMU clusters are given in Table 10. 

5.2 Results of the Sensor Location Parametric Study 

The results obtained for the sensor location effects study are 
presented in Table 11 for those cases in which sensor failures are not 
present. They indicate that the effects of lateral separation are not 
significant (Case 4 vs. Case 6). A similar result can be expected when 
the sensor clusters are separated in the normal direction since the 
structural mode coefficients are only longitudinally dependent. False 
alarms occur when at least one half of the RSDIMU is placed at the rear 
of the aircraft (Cases 3 and 5). The airplane response also becomes 
unstable with both halves of the RSDIMU located far aft of the c.g. This 
instability may be due to the destabilizing influence of the pitch rate 
feedback term induced by the normal accelerometer lever arm term. False 
alarms did not occur in those cases in which the sensors are located 
forward of the aircraft c.g. 

The results for the cases in which sensor failures are introduced 
are summarized in Table 12. Only two locations were considered, FS77 and 
FS313. No problems were encountered with the FDI system. For example, 
the gyro channel performed perfectly despite the long time it took to 
detect the 3.0 deg/hr failure introduced during the loiter maneuver. In 
addition, the order in which the sensor failed did not affect the 
results. 

The analytic compensation of the accelerometer outputs for the 
lever arm effects was also evaluated during this phase of the study. 
Basically, the lever arm terms of Eqs. (3) and (4) were computed using 
the RSDIMU outputs. The angular accelerations were obtained by passing 
the RSDIMU angular velocities through washout filters. This approach was 
abandoned after simulation evaluation due to the fact that it introduced 
false alarms into the system. It was found to be better to include a 
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Table 10 

Location of RSDIMU Clusters Relative to Vehicle c. g 


LOCATION 

x— DISTANCE 
(Meters ) 

y-DISTANCE 
(Meters ) 

Z— DISTANCE 
(Meters ) 

FS77 

6.172 

.4572 

.3048 

FS200 

3.048 

.4572 

.1524 

FS313 

.1777 

+.4572 

0 

FS563 

-6.172 

.4572 

-.4572 
























Table 12 

The Effect of Sensor Location on FDl System Performance 
In the Presence of Failures 
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term in the FDI system thresholds to account for the accelerometer lever 
arm effects than to analytically compensate the accelerometer outputs for 
their presence and not account for them in the thresholds. The analytic 
compensation process introduced high frequency uncertainties into the 
system due to the differentiation of the angular rates which resulted in 
false alarms. 

5.3 The Effect of the Magnitude of the Structural 

Modes on FDI System Performance 

The results are summarized in Table 13 with the effects of sensor 
location and changes in the magnitudes of the structural modes 
presented. Deviations of about 20% from the nominal structural mode 
coefficients led to a false alarm in the gyro soft failure detection 
channel. The accelerometer soft failure channel is less sensitive to the 
structural inodes since a false alarm was not induced when their magnitude 
was increased by 20%. 

5.4 Summary and Conclusions 

This phase of the study dealt with an investigation of the effects 
of sensor location on FDI system performance. The results indicate that 

• Location of the RSDIMU aft of the vehicle c.g. is neither 
desirable nor acceptable. However, an assessment of the impact 
of the RSDIMU on the stability and control of the aircraft 
system is a complex problem which must be addressed from the 
integrated systems point of view. 

• The effects of lateral and normal separations of the RSDIMU on 
the FDI process are not very significant. 

• The analytic compensation of the accelerometer outputs for 
lever arm effects resulted in poor FDI system performance and 
false alarms. 
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Table 13 

The Effect of the Magnitude of the Structural Mode 
Coefficients on FDI System Performance 
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A second task involved a parametric study of the effects of the 
magnitude of the structural modes on the FDI system. It was concluded 
for this phase of the study that 

• The gyro channel is more sensitive to variations in the 
structural modes than the accelerometer channel. 

• Structural mode effects which are large relative to the other 
RSDIMU uncertainties may adversely impact the performance of 
the FDI algorithm. 
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SECTION 6 


THRESHOLD GENERATION USING NOISE COMPENSATION 
AND FILTERED PARITY EQUATION RESIDUALS 


6.1 Introduction 

The threshold generation scheme used up to this point in the 
program is that developed in Section 2 of this report and designated the 
least squares estimation approach. The structural mode and accelerometer 
level arm threshold effects are obtained by 

• calculating a least square estimate of the linear accelerations 
and angular velocities. 

• estimating the sensor outputs using these estimated parameters. 

• subtracting the actual and estimated sensor signals to obtain 
an estimate of the sensor uncertainties. 

• solving the parity equations using these sensor uncertainties. 

• using the absolute values of the parity equation residuals 
obtained in the thresholds. 

The above defined approach has several shortcomings. In 
particular, it does not include noise compensation as developed in 
Section 4. Furthermore, the parity equation residuals obtained with this 
approach are corrupted by the sensor errors. It has been demonstrated 
that the presence of these sensor error effects can lead to false alarms. 
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6.2 


The Reformulated Threshold Algorithm 


An alternate approach to threshold generation was explored to 
overcome these shortcomings. A block diagram of the scheme mechanized is 
shown in Figure 14. Noise compensation, as developed in Section 4, is 
included. In addition, the threshold terms, required to compensate for 
the structural mode effects, are obtained by filtering the parity 
equation residuals. This approach was recommended by F. Morrell of NASA 
Langley. The structural mode effects are high frequency in nature. 

Their frequencies are much higher than those of the bare airframe of the 
vehicle. The quantity required to compensate for the structural mode 
effects in the thresholds is given in Eq. (9) and can be obtained exactly 
by washout or high pass filtering the parity equation residuals. 

A slightly different approach is required with the accelerometer 
lever arm effects. In this case, both low and high frequency compensa- 
tion must be considered. The high frequencies are important during 
vehicle transients while the low frequencies are significant during slow 
maneuvers such as a loiter. The high, frequency portions of the lever arm 
contribution to the threshold are obtained with the high pass filtering 
of the parity equation residuals. The low frequency portion can be 
obtained by calculating the accelerometer lever arm effects using the 
analytic egression of Eq. (4). The angular accelerations required to do 
this can be obtained by high pass filtering the angular rates. The 
effect of the low frequency lever arm uncertainties on the individual 
sensors can be obtained by resolving these uncertainties through the 
sensor geometry matrix. The lever arm effects required for the thresh- 
olds can be obtained by low pass filtering the resultant residues and 
adding in the high frequency contribution obtained by filtering the 
parity equations. The low pass and high pass filters used in this 
process are complementary. 

The filtered parity equation approach to threshold generation is 
not without its potential shortcomings. Specifically, a problem could 
arise with the acceleration channel when an undetected gyro failure is 
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Figure 14. Block Diagram of Failure Detection Process Using Noise 
Compensation and Filtered Parity Equation Residuals 





present. In this instance, the estimated angular rates of the vehicle 
are corrupted by the gyro failure which, in turn, affects the estimates 
of the linear acceleration due to the lever arm effects. Since this 
quantity is low pass filtered the undetected gyro failure affects the 
threshold. The consequences of its effect cannot be predicted. If the 
threshold is lowered a false alarm could result or if the threshold is 
increased the failure could go undetected or a longer detection time 
could result. The problem just discussed was evaluated via simulation. 

It was shown to be of only negligible concern for small undetected gyro 
failure. Large undetected gyro failures affect the vehicle controllabil- 
ity which is a problem of much greater consequence. 

The estimates of the gyro and accelerometer structural mode and 
high frequency lever arm effects required for the thresholds are not 
affected by an undetected failure. Each of these quantities is obtained 
by high pass filtering the parity equation residuals and the effects of 
an undetected failure will not be transmitted. 

The noise compensation is not affected by an undetected failure 
since both a p and a egE increase to reflect the presence of the failure. 
a egE is substracted from a p so that the effect is cancelled out and a n is 
correct. 

The effect of an undetected sensor failure on the estimates of the 
sensor error effects for the threshold is second order in nature. The 
estimated angular rates or linear accelerations are modified by the 
nominal estimate of the sensor error which greatly reduced its effect. 

6.3 Algorithm Evaluation 

The values of the time constants for the washout and low pass 
filters required for the estimates of the structural mode and lever arm 
effects for the thresholds were determined via simulation. Noise and 
sensor error effects were not included and a trial and error approach 
employed. The washout time constants were selected by comparing time 
histories of the actual and estimated effects. The low pass filter time 
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constant for the accelerometer lever arm effects was set equal to that of 
the high pass filter in complementary filtering fashion. The value of 
the accelerometer time constants was confirmed for both the structural 
mode and lever arm effects. For this phase of the study, the RSDIMU was 
located at FS313 and FS77. Sensor failures were also considered but only 
the soft failure channel was dealt with. 

Based upon the results obtained, washout filter time constants of 
15.0 sec and 25.0 sec were selected for the accelerometer and gyros 
respectively. The accelerometer low pass filter time constant is 15.0 
sec. Several tradeoffs are present in the selection of these time 
constants. If the washout time constants are made larger, the struc- 
tural mode and high frequency lever arm estimates contain lower frequen- 
cies. However, a longer failure detection time results. On the other 
hand, if the washout filter time constant is smaller, the desired 
estimates are not adequate and false alarms result. These tradeoffs were 
evident with the range of simulation runs made to select the filter time 
constants. 

The FDI threshold generation algorithm developed in this section 
was evaluated in much greater detail. More specifically, the sensitivity 
of the FDI system performance and the gyro soft failure channel in 
particular to noise and second order system filter time constant was 
determined. The results for straight and level flight are presented in 
Figure 15. Three 2.0 deg/hr failures were injected into the system at 
100, 200 and 300 seconds during a 400 sec run. The noise level that can 
be tolerated increases with the second order filter time constant. A 
filter time constant that is longer than 40 seconds is not considered, in 
order to prevent possible masking out of a failure if it occurs immedi- 
ately after the previous failure or in between maneuvers and also to 
prevent long detection delay. 

Figure 16 shows the performance of the FDI system being evaluated 
in maneuvering flight. The 1800 second flight profile of Table 2 is used 
with 2.0 deg/hr failure introduced at 500, 1000 and 1500 sec into sensor 
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GYRO NOISE LEVEL (deg/h) 



SECOND ORDER FILTER TIME CONSTANT (s) 

A FALSE ALARM 
▲ DETECTED 

Figure 15. Noise Level vs. Time Constant for Straight, Level Flight, 
Failure Level 2 Deg/Hr 
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axes 8, 6 and 4, respectively. The tolerable noise level appears to be 
linearly related with the time constant between 20 and 40 seconds. The 
tolerable noise level for this range of time constants is lower than that 
for straight and level flight. 

6.4 A Threshold Algorithm Modification for Reconfiguration 

The threshold function, defined in this section, was also modified 
to account for the memory of the low pass filters associated with it. In 
the event of failure detection and isolation, the sensor system is 
reconfigured, the number of parity equations reduced and the threshold 
function changed to reflect this reduction. This is accomplished by 
changing a subset of the parity equations and setting others to zero. 

Step decreases in the threshold function result. It has been observed 
that after reconfiguration, the detection function can increase before 
the threshold function can respond to compensate for such effects. The 
reason for this is that the filters retain some information reflecting 
the state of the system prior to failure isolation. To prevent false 
alarms arising because of this phenomena, the threshold function has been 
modified so that it decays exponentially when a failure is detected and 
isolated. A time constant of 20 sec has been used for the filter. 

The subject of threshold transition after failure detection and 
isolation is addressed in Figure 17. The failure detection decision 
function is shown in the top time history. 2.0 deg/hr failures were 
injected into the system at the times indicated. The middle time history 
is the gyro threshold without an exponential decay after failure detec- 
tion and isolation. An instantaneous change in the threshold occurs 
after the detection and isolation of the second failure which results in 
a false alarm. The gyro threshold function with an exponential decay 
after failure isolation is shown in the bottom figure and correct detec- 
tion and isolation of all three failure occurs. 
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GYRO NOISE LEVEL (deg/h) 
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6.5 


Effect of Sensor Location on Navigation Performance 


The reformulated threshold algorithm was also used to evaluate the 
effect of sensor location on navigation performance. Simulation runs 
were made using the following locations for the RSDIMU. 

• All sensors located near the aircraft center of gravity , FS313 

• All sensors located near the front of the fuselage at FS77 

• One-half of the RSDIMU at FS313 and the other half at FS77 
(nominal case). 

Each case was run with and without failures. 

Table 14 lists the error ranges for different navigation variables 
obtained for the 1800 second evaluation run with no failures present. 

All four sensors were used. The range of error magnitudes is comparable 
for all combinations of sensor locations. The biggest difference among 
the error variables for the different locations is that the error 
trajectories are not equally smooth for all variables. For example, the 
altitude rate error time history was smoothest when both halves of the 
RSDIMU are near FS313. A similar difference in smoothness was evident 
for the yaw angle error. This time, however, the curve is noisiest for 
all sensors located at FS313. All other navigation error time histories 
were similar in nature and noise characteristics for all RSDIMU sensor 
locations. 

The simulation run which resulted in Table 14 was repeated with 
soft accelerometer failures injected into the system to see what 
influence, if any, this would have on navigation system performance. The 
failures were detected and correctly isolated. No major differences 
between the failure and no failure cases were evident. 

The effect of sensor location on navigation error when only two 
sensors are in use was also examined. The outputs of only two sensors 
will be used for navigation purposes in an operational system so that 
sensor failures will not affect navigation accuracy. Multiple navigation 
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Table 14 

Maximum Positive and Negative Errors During 1800 Second Evaluation 
For Various RSDIMU Sensor Locations - No Failures 
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solutions based on all combinations of two sensor outputs will be gener- 
ated. Only solutions obtained from failure-free sensors are valid. 
Switching from the failure-contaminated solutions to the failure-free 
solutions will be part of the system reconfiguration. 

Simulation runs were made using the following locations for the 
sensor pair; 

• Two sensors located near the front of the fuselage at FS77. 

• One sensor located near the front of the fuselage at FS77 and 
the other near the aircraft center of gravity at FS313. 

• Two sensors located near the center of gravity at FS313. 

The results obtained from the simulation runs were compared to each 
other, as well as to the nominal case, where four sensors were used, two 
at FS77 and two at FS313. Figure 18 illustrates the results for altitude 
rate errors. Figure 18b indicates that the error obtained with two 
sensors at FS77 is even smaller than those obtained for the four sensor 
nominal case of Figure 18a. The difference in results can be quite large 
for some variables, as Figure 19 shows for the east velocity error. 

The results of Figures 18 and 19, however, represent only a few 
samples from the spectrum of those possible. CSDL could not draw a 
general conclusion regarding the preferable location for a sensor pair 
with regard to navigation system performance. A covariance, rather than 
a deterministic, approach to the problem is suggested as a preferable way 
to obtain the desired conclusion. 

6.6 Results of Sensor Error Parametric Study on FDI Performance 

Attempts to reduce the level of the threshold function derived in 
Section 6.4 were made in order to improve the soft failure detection 
capability of the FDI algorithm. The lower the threshold level, however, 
the higher the probability of false alarm. In order to determine a lower 
limit on the level of the threshold function, a parametric analysis was 
conducted in which the sensor error terms represented in the threshold 
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.244 (.8)-( 


a) 

-.244 (-.8) 

.122 (.4) 

b) 

-.244 (-.8) 

.366 (1.2) 

c) 

-.244 (-.8) 

.244. (.8) 

d) 

-.244 (-.8): 


Figure 18. Altitude rate error when only two sensors are used 
in m/s (fps) 

a) Nominal Case: Two sensors at FS77, two at FS313. 

b) Two sensors at FS77. 

c) One sensor at FS77, and one at FS313. 

d) Two sensors at FS313. 
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Figure 19. East velocity error when only two sensors are used 
in m/s (fps) 

a) Nominal Case: Two sensors at FS77, two at FS313. 

b) Two sensors at FS77. 

c) One sensor at FS77, and one sensor at FS313. 

d) Two sensors at FS313. 
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were lowered simultaneously until a false alarm was obtained. For both 
the accelerometer and gyro sensors, the following error terms were 
considered: 

• instrument bias 

• misalignment 

• scale factor 

• g-sensitivity due to 1-g flight 

For the gyros, the g-sensitivity and instrument bias error effect were 
combined into one term in the threshold since the flight trajectory is 
nominally 1-g. 

The 1800 second simulation trajectory was used in order to examine 
the effect of maneuvers on lowered threshold levels. The results 
obtained are shown in Table 15 for the accelerometer and in Table 16 for 
the gyroscopes. These results indicate how low the threshold level can 
be set before obtaining false alarms. 

The threshold error terms can be lowered significantly from the 
nominal values. No failures were injected into the simulation runs up to 
this point. A subset of these runs was, however, repeated with soft 
accelerometer and gyro failures injected into the system to see whether 
the results of Tables 15 and 16 were still valid when only two or three 
sensors are functioning. It was found that the results are indeed repre- 
sentative for cases with as well as without failures. 

6.7 The Effect of Failure Order on FDI Performance 

A large number of simulation runs were made to determine whether 
failing two sensors in different order or at different times affected 
failure detection and isolation system performance. For this set of 
experiments, one half of the RSDIMU was placed at the front of the 
fuselage (FS77) and the other half at the center of gravity (FS313). The 
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Table 15 

Accelerometer Threshold Sensor Error Values 
For Parametric Study 


ERROR 

TERM 

UNIT 

NOMINAL 

VALUE 

LOWEST VALUE 
WITHOUT 
FALSE ALARM 

FIRST VALUE 
RESULTING IN 
FALSE ALARM 

Instrument Bias 

ug 

150. 

25.0 

18.5 

Misalignment 

prad 

86.6 

21 .5 

16.5 

Scale Factor 

ppm 

86.6 

21 .5 

16.5 

g-sensitivity 

ug/g 2 

90. 

35 

31 .5 


Table 16 

Gyro Threshold Sensor Error Values 
For Parametric Study 


ERROR 

TERM 

UNIT 

NOMINAL 

VALUE 

LOWEST VALUE 
WITHOUT 
FALSE ALARM 

FIRST VALUE 
RESULTING IN 
FALSE ALARM 

Instrument Bias 

deg/hr 

0.03 

0.0054 

0.0045 

Misalignment 

prad 

150 

37.5 

32.5 

Scale Factor 

ppm 

60 

15 

12.5 

























following simulation runs were made for both the gyros and the acceler- 
ometers separately: 

• Two sensors at FS77 failed 

• One sensor at FS77 and one sensor at FS313 failed 

• Two sensors at FS313 failed 

For these runs, the 1800 second as well as the all-cruise 500 second 
simulation trajectories were used* Two soft failures were introduced 
separately for the gyro and the accelerometer during the 1800 second 
simulation trajectory, one at 1000 seconds and the other at 1500 
seconds. For the 500 second simulation run, they were injected at 150 
and 300 seconds. Accelerometer failures of 0.003 g were injected, while 
for the gyro the magnitude was 2.0 degrees/hour. In all instances, the 
failure order had no effect on either the occurrences of false alarms or 
false isolation. All failures were detected and isolated within 25 
seconds. Detectability for the second failure, however, varied depending 
on which instruments had already been isolated. This issue was discussed 
in Reference 1 • 

6.8 Summary 

A reformulation of the FDI system threshold generation algorithm 
using noise compensation and filtered parity equation residuals for 
structural mode and lever arm effects has been examined. This technique 
provides exact compensation of the high frequency structural mode and 
lever arm effects in a computationally efficient manner. The low 
frequency lever and compensation terms are computed using the angular 
velocities computed by the RSDIMU. A shortcoming with this approach was 
discussed, which can arise due to the presence of an undetected gyro 
failure. Potential consequences of this shortcoming are false alarms or 
undetected accelerometer failures. Suitable values for the time 
constants of the filters associated with this algorithm were 15 sec for 
the accelerometers and 25 sec for the gyros. The performance of the 
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reformulated FDI threshold generation algorithm was evaluated in the 
presence of noise as a function of the time constant of the second order 
low pass filter associated with the gyro soft failure channel, A greater 
tolerance to noise was indicated with increasing second order filter time 
constant* Maneuvering flight also decreased the system performance in 
the presence of noise* 

Consideration was also given to the evaluation of an exponential 
transition in the threshold when reconfiguration of the FDI system 
occurs. This feature was included to prevent false alarms as indicated 
by the simulation results included in the report. 

An investigation of the effect of sensor location on the naviga- 
tion performance of the aircraft system with an RSDIMU was presented* 

Only minor differences were evident* In order to enhance the FDI’s soft 
failure detection capability, a threshold sensor error parametric study 
was conducted to determine how low the thresholds can be set before false 
alarms are obtained. Significant reductions can be implemented* 

Finally, simulation runs were carried in order to determine whether the 
order in which failures occur has an effect on FDI performance* No 
difference was evident* 



SECTION 7 


A GLT EDI SYSTEM STRATEGY BASED ON THE 
PAIRWISE COMPARISON OF SENSOR MEASUREMENTS 


7.1 Description of the Algorithm 

An FDI methodology which combines the detection and isolation 
process in one step, is described in this section. Previously, one 
parity vector p was calculated using a set of eight measurements, output 


by four sensors. The detection decision function used, DF r 


T 

p p, was 


derived based on a Generalized Likelihood Ratio Test and the existence of 
a failure was declared if the detection decision function exceeded a 
prespecified threshold. Next, the failure was isolated based on the 
function DFj^ given by Eq. (2) for each sensor j. The isolation 
decision is then made by determining max j (DF^). The value of j that 
maximizes DFj_. identifies the sensor that is most likely to have failed. 

The methodology suggested here is also based on a Generalized 
Likelihood Test, but instead of obtaining a single parity vector based on 
all measurements, each possible pair of sensors is used to generate one 

parity vector, and, in turn, a detection decision function. This gives a 

r 4\ 

total of = 6 decision functions, each to be compared to a threshold. 
Thus, for a pair of sensors i and j, the parity vector p^j is defined as 


Oil - IV 2i-1' V 2i- V 2j-,’ V 


m 


2i-1 


m 


2i 


m 


2j-1 


in . 
2j 
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and the corresponding decision function is 



P ij P ij 


(14) 


Since each sensor is represented in three decision functions, a decision 
on whether a failure occurred, and, if so, which sensor to isolate it to, 
can be made concurrently. Table 17 illustrates this process for a 
failure in sensor 2. The number of decision functions which exceed the 
threshold for a sensor j is called the degree of measurement inconsis- 
tency of sensor j, or D. . Thus, as Table 17 indicates, = 1 f D « 3, 

= 1 , = 1 , assuming, of course, that all the GLT tests ran success- 

fully. 

In practice, a decision to isolate sensor j is taken if Dj 2 2. 
Thus, for each sensor pair i,j, define the logical variable 

F = DF d > T (if j = If. ,4 i * j) 

ij 3 

Considering sensor 2, construct the logical expression 

G 2 " (F 12 and F 23 ) ° r (F 12 and P 24 ) ° r (F 23 and F 24 } 


If D 2 2 2, then at least one of the expressions in parentheses in the 

above equation will be true, which means G 2 will be true or equal to 

one. For sensor 1, however, D =1, so that F » 1 , and F ^ = F , = 0. 

1 12 1314 

Thus, 


(F 12 and F 23 ) ° r (F 12 and F 13 ) ° r (F 13 and *23* 


(1 . 0 ) + (1 . 0 ) + (1 . 0 ) = 0 


To isolate a second failure, given instrument i has failed. 
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Table 1 7 

Example Illustrating Degree of Inconsistency 
For Each Sensor When Sensor 2 is Failed 



SENSOR 


1 

2 

3 

4 

Is DF > T ? 

D, 2 12 

Yes 

Yes 

- 

- 

!S DF > T ? 

13 

No 


No 

No 

IS DF > T? 

D 14 14 

No 

- 


No 

IS DF > T ? 

23 

- 

Yes 

Yes 

- 

IS DF ' > T. .? 

D 24 

24 

- 

Yes 


Yes 

IS DF > T ? 

D 34 

34 


- 

No 

No. 

Degree of sensor 
inconsistency 

D i = 1 

°2 " 3 

°3 " 1 

°4 " 1 
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G. 

3 


= F F , 
D* jZ 


where i , j, k, Z is a cyclic permutation of 1, 2, 3, 4. That is, 


Instrument 1 Instrument 2 Instrument 3 Instrument 4 

Failed Failed Failed Failed 


G 2 " 

F F 
23 24 

G i 

— 

F F 
13 14 

G i 


F F 
12 14 

G 1 

3 = 

F F 
12 13 

G 3 = 

F F 
23 34 

G 3 

= 

F F 
1 3 34 

G 2 

= 

F F 
12 24 

G 2 

- 

F F 
12 23 

G 4 = 

F F 
24 34 

G 4 

= 

F F 
14 34 

G 4 

= 

F F 
14 24 

G 3 

= 

F F 
13 23 

terms 

of the < 

degree 

of 

incons i s tency , 


= 2 if 

sensor 

j 

is failed. 


or Dj = 1 otherwise, as shown in Table 18, for the case where sensor 2 
was first failed, and sensor 1 failed second. 

It can be seen that this algorithm resembles the Edge Vector Test, 
described in Reference 1, with its overall logic of comparing pairs of 
sensor measurements. One difference is that the parity equation coeffi- 
cients, given in Table 19, are derived based on an algorithm, given in 
Reference 4, which uses a least square approach. More important, the 
decision function is obtained through a statistical hypothesis test, 
namely, the GLT. The EVT's decision function, on the other hand, is 
based on the projection of measurements taken by two sensors along the 
line of intersection of the same two sensors* planes. 

7.2 The Algorithm's Sensitivity to Failures 

The orientation of the sensors with respect to the vehicle body 
axes and the resulting system of parity equations have a profound effect 
on the magnitude of sensor failures which can be detected and isolated. 
This aspect of the FDI problem for the redundant IMU sensor configuration 
and the algorithm under consideration is explored in this section. 

Single degree-of -freedom instrument failures are assumed because it 
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Table 18 

Example Illustrating Degree of Inconsistency 
For Each Sensor When Sensor 1 is Failed, 
After Sensor 2 Has Been Correctly Isolated 




SENSOR 



1 

3 

4 

IS DF 

°13 

> T *> 
13 

Yes 

Yes 

- 

IS DF 

°14 

> T ? 
14 

Yes 

— 

Yes 

Is DF 

°34 

> T ? 
34 


No 

No 

Degree of sensor 
inconsistency 

D i - 2 

°3 " 1 

tl 

Q 
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Table 1 9 

Parity Equation Coefficients 
For Pairwise-Comparison GLT Algorithm 



Coefficients of 
First Sensor 

Coefficients of 
Second Sensor 

First Axis 

Second Axis 

First Axis 

Second Axis 

Adjacent 

Instruments 

1 & 2 , 3 & 4, etc. 

.68301 

.18301 

-.18301 

-.68301 

Two Opposite 

Sensors 

1 & 3, 2 & 4 

.5 

■ 

.5 

-.5 

















simplifies the discussion and gives insight into the area of FDI sensi- 
tivity, and because failure modes of this nature are a distinct possibil- 
ity with TDOF gyros. 

The parity equations attenuate the effect of a sensor failure, 
thus reducing its magnitude in the parity-equation residuals. To illus- 
trate this fact, consider a failure of magnitude b in Axis A. The 
measurement would be 






Axis Ai n 

[ 

•H 

< 

a 

1 


b 


Uncertainties 

= 

o 

+ 

Axis Bi 

m. 

L Bl J 


_ — 


Uncertainties _ 


The parity vector is 


! . 6830b + Residual term if i,j are adjacent sensors 

. 

• 5b -f Residual term if i,j are separated sensors 

where 



f 

-H 

< 

a 

\ 


( 

-H 

< 

a 

1 

m. . = 

ID 

m 

Bi 

' V iJ ■ IV 2i-,' V 2i'V>'V' "ij ■ 

P Bi 


m_ . 

ad 


P Aj 


m„ . 

L B]J 


- Pb d _ 


This failure magnitude is reflected in the decision function as 
follows: 


DF 

D. . 
ID 


p ij p ij = 

J (.6830b) 2 
I (.5b) 2 




+ Residual term 
+ Residual term 


m ij (V ij V ij )m ij 


if i,j are adjacent 
if i,j are separated 
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The failure detection sensitivity of sensor i can now be defined 

as the square root of the coefficient of the term due to failure in the 

decision function DF D _ • This is exactly the same definition used in 

Reference 1 for the GLT algorithm, where sensitivity is defined as the 

square root of the sum of the squares of the elements of a column of the 

parity equation matrices. Table 20 lists these coefficients, where it is 

seen that uniform detectibility of the first failure does exist with this 

algorithm, since all of the coefficients obtained for it are permutations 

of each other. The ability to detect failures degrades for the second 

and third failures, and the magnitude of failure which can go undetected 

is larger for three instruments than it is for four. When failure 

detection for the two-instrument clusters is considered, it is once again 

evident that a failure larger than that needed in the three- or four- 

* 

instrument cases has to occur before it is detected* Table 20 shows that 
the disparity is most evident when, for instance, sensors 1 and 4 are 
already failed and the third failure occurs in one of the two inner axes 
of the remaining sensors, namely sensors 2 and 3. In this instance, the 
failure must be 2.732 times larger than the minimum failure magnitude 
detected the first time. 

7.3 Threshold Selection 

The thresholds used with this algorithm can be generated using a 
method very similar to that used for the GLT algorithm, as described in 
Section 2.6. They also consist of a constant portion and a dynamic 
portion. The dynamic thresholds are again generated from an analytic 
expression for the upper bound of the sensor errors and parity-equation 
residuals. As with the GLT algorithm, the failure-decision functions are 
the sum of the squares of the parity-equation residuals, except that 
sensors are taken two at a time. 

Consider the development of the thresholds for a sensor pair i,j. 
Following Eq. (8), the parity equation residuals is given by 
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Table 20 

Pairwise Comparison GLT Sensitivity Coefficients 
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4 

p.. = £ V 6 m + structural mode terms i,j = 1,...,4 

1 T • ^ # g « £ 9 

k=1 x] x * } 

An upper bound for p^j is, as in Eq. (9) 


e 

<o 

II 

1 V. 1 

1 + structural mode terms 

m. . \ " 

13 k =1 

k. . 
1 D 

/ 1 1 


Given the failure decision function DF D _ E< 5* H4), the upper bound 
for DFri. . is 

u i3 


T. . 

13 



) 2 


The constant portion of the threshold is added to this when it is neces- 
sary to account for quantization and sensor noise as in the hard-failure 
channel. 

One additional important conclusion can be drawn regarding the 
thresholds determined for the GLT. The thresholds are not a function of 
the number of instruments in the configuration. This means that the 
lower failure-detection sensitivity evident in Table 20 for a configura- 
tion with fewer sensors in the cluster is not compensated for by a corre- 
sponding lowering of the failure-detection thresholds. 


7.4 Simultaneous Failures 

This section considers the effect of simultaneous failures on the 
pairwise-comparison GLT algorithm. Simultaneous failures can occur, for 
instance, if a sensor is physically damaged, so that the two axes of that 
sensor would show corrupt measurements. In a tetrahedral RSDIMU with two 
separable halves, two sensors, i.e*, four measurements, can become 
invalid at the same instant if damage occurs in that area of the airplane 
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where that half is located. In this section, cases with only two simul- 
taneous failures will be considered. 

As an example, consider the case where the two axes of sensor 1 
fail, axis A with magnitude b-j , and axis B with magnitude b 2 » The 
effect on decision function df d-j 2 


DF D 12 P 1 2 P 1 2 ^ V 12 m i2^ ^ V 12 m i2^ m i2 V 12 V 12 m i: 


= (.6830b 1 + .1830b 2 > + Residual term 


The effect on decision functions df d 1 3 an ^ is, respectively, 

2 

DF = .25 (b - b ) + Residual term 

13 

2 

DF = (.1830b + .6830b ) + Residual term 

°14 1 2 

This means that the effect on the two adjacent sensors is super additive, 
and that on the one opposite sensor is subadditive. Since it is suffi- 
cient to have two decision functions crossing the threshold, sensor 1 
will be detected and correctly isolated. 

Consider now the case where the A axis of both sensor 1 and sensor 
2 has failed, the first with a failure magnitude b-| and the second with 
a failure magnitude b 2 , both failures being in the positive direction. 

The effect on each of the decision functions is listed in Table 21 • It is 
seen that the effect on df d 12 * s suka^ditive, so that if, for instance, 
b - ( • 6830/ • 1 830 )b , no effect will be seen at all. Table 22 shows that 

^ I 

the algorithm cannot handle such a case. If DF Dl ^ fails to cross the 
threshold, the degree of inconsistency of each of the four sensors will 
be 2, and with the algorithm as it is, all four sensors will be isolated. 
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Table 21 

Effects of a Failure of Axis A 
in Each of Sensors 1 and 2 on Decision Functions 



FAILURE OF 
MAGNITUDE b-j 
ON A AXIS IN 
SENSOR 1 ALONE 

FAILURE OF 
MAGNITUDE b 2 
ON A AXIS IN 
SENSOR 2 ALONE 

FAILURE OF MAGNITUDE 
b ! on A AXIS OF SENSOR 1 
AND OF MAGNITUDE b 2 ON 
A AXIS OF SENSOR 2 

<5DF„ 

°12 

( .6830b 1 ) 2 

(.1830b 2 ) 2 

( .6830b ^ - .1830b 2 ) 2 

6df 

D 13 

(.Sb^ 2 

0 

( • 5b 1 ) 2 

<5DF_ 

°14 

(.1830b 1 ) 2 

0 

( . 1 830b 1 ) 2 

6DF_ 

D 23 

Q 

(.6830b 2 ) 2 

( . 6830b 2 ) 2 

6DF_ 

°24 

o • 

<.5b 2 ) 2 

(.Sb/ 

6DF_ 

°34 

0 

0 

0 
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Table 22 

Degree of Inconsistency for Each Sensor 
When Sensors 1 and 2 are Failed 


DECISION 

FUNCTION 

SENSOR 

1 

2 

3 

4 

Is DF^ 

D 1 2 

> T ? 
12 

Yes or No 

Yes or No 



Is DF 

°13 

> T 9 
13' 

Yes 


Yes 


Is DF 

°14 

> a 14' 

Yes 



Yes 

Is DF 

D 23 

> T ? 
23 


Yes 

Yes 


Is DF_ 

°24 

> T ? 
24 


Yes 


Yes 

IS DF 

°34 

> - T ? 
34 



NO 

No 

Degree of 

Sensor 

D^ = 3 or 2 

D = 3 or 2 

D- = 2 

D. = 2 

Inconsistency 

2 


4 
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The last example above illustrates a limitation of the algorithm 
which occurs whenever two different sensors fail simultaneously, and the 
failures are in the same direction and of comparable magnitude. If b^ 
is much larger than b or vice versa, for instance if b^/l^ > 5 or 
b 2 /b 1 > 5, then the failures will not be totally masked and the chances 
are improved that correct isolation will occur. For this reason, the 
algorithm must be constructed so that a degree of inconsistency Dj = 3 
is required if Dj = 2 for more than one sensor j. This will prevent 
the simultaneous isolation of more than two sensors. Finally, Figure 20 
shows a flow diagram of the modified algorithm. 

7.5 Conclusion 

A new FDI system strategy for failure detection and isolation has 
been presented in this section. The following conclusions regarding this 
methodology can be drawn from this phase of the study: 

• The algorithm offers a concrete strategy for dealing with two 
simultaneously occurring failures. 

• Limitations on this capability do exist, as described in 
Section 7.4. 

• It is still premature to consider this FDI as a potential 
alternative to the original GLT algorithm, since experience 
through simulation is still needed. The strategy is, however, 
worth pursuing further. 
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Figure 20. Flowchart for Pairwise Comparison Algorithm 
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SECTION 8 


SUMMARY AND CONCLUSIONS 


The basic goal of this study effort was to further develop and 
refine the technical knowledge and skills needed to make redundant 
strapdown inertial measurement units a viable component of the aircraft 
avionics system inventory. This study was specifically addressed to the 
RSDIMU being developed and evaluated by the NASA Langley Research 
Center. Two major tasks were undertaken: Aeroelastic Effects Analysis 
and Failure Decision Function Compensation Analysis. 

In Section 3, compensated and uncompensated GLT FDI algorithm 
decision functions were compared. The intent was to determine if the 
compensated GLT decision functions could be employed to eliminate the 
need for the dynamic FDI thresholds required with the uncompensated 
decision functions. The compensated decision function was very sensitive 
to the variance of the sensor errors, implying that constant thresholds 
can only be obtained if these parameters are known accurately for a given 
sensor package. In addition, failures tended to be masked during 
maneuvers. On the other hand, the algorithm was quite sensitive to soft 
sensor failures and the approach deserves further consideration. 

The investigation of the compensated GLT decision function 
provided a basis from which to consider the compensation of noise in the 
GLT thresholds. This compensation is required to eliminate false alarms 
which can arise if noise effects are not taken into account. An 
algorithm to achieve noise compensation was developed, implemented and 
evaluated. An investigation of the impact of the FDI system low pass 
filter time constant on system performance with noise present was also 
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conducted. It was concluded that noise compensation is still required 
even though larger filter time constants lessen the detrimental effects 
of noise. 

An important consideration in the design of RSDIMUs is the impact 
of sensor location and magnitude of the structural modes on FDI system 
performance. This subject was addressed in Section 5. It was determined 
that location of the sensors aft of the vehicle c.g. is not desirable , 
that lateral and normal separation of the RSDIMU are not significant and 
that analytic compensation of the accelerometer outputs for lever arm 
effects inhibits FDI system performance. 

An FDI system threshold generation scheme was developed and 
evaluated in Section 6. This algorithm incorporated noise compensation 
and filtered parity equation residuals. The filtering of the parity 
equation residuals provided a means of obtaining the exact compensation 
of the high frequency structural modes and lever arm effects required for 
the thresholds. This algorithm was evaluated for different noise levels 
and second order filter time constants in both cruise and maneuvering 
flight. A brief investigation of the effects of RSDIMU sensor location 
on navigation system performance was conducted. In order to enhance the 
FDI 1 s system soft failure detection capability, a sensor error parametric 
study was conducted to determine how low the threshold can be set without 
obtaining false alarms. Simulation runs were also carried in order to 
determine whether the different orders in which failures can be injected 
have different effects on FDI system performance. No difference was 
evident. 

A GLT FDI system strategy based on the pairwise comparison of 
sensor measurements was described in Section 7. The advantage of this 
strategy is its ability to detect two simultaneously occurring failures, 
although limitations do exist on this capability. 
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